io.github.nagarjunr/data-connectors-postgres (PostgreSQL) MCP Server

Read-only MCP server for PostgreSQL that supports inspecting database structure and executing guarded queries. It provides developer-facing access for workflows that need to discover schemas and tables and then retrieve data under enforced query constraints.

🛠️ Key Features

Read-only access to PostgreSQL
List database schemas and tables
Run guarded queries
Categorized as a data connector for pipelines and agent workflows

🚀 Use Cases

PostgreSQL-backed RAG data retrieval
Building data pipelines and data connectors
Integrating with AI agents that require database discovery and controlled querying

⚡ Developer Benefits

Clear separation of read-only inspection vs. query execution
Supports structured access patterns for PostgreSQL data
Fits common connector/tooling workflows referenced by the topics (e.g., python, llm)

⚠️ Limitations

Read-only (no write operations)
Query execution is “guarded,” implying restrictions beyond unrestricted SQL access

PostgreSQL MCP Server

Read-only MCP server exposing PostgresClient to AI agents: list schemas/tables, run guarded SQL queries.

Tools

Tool	Description
`list_schemas() -> list[str]`	List all schemas in the database
`list_tables(schema: str = "public") -> list[str]`	List tables in a schema
`query(sql: str) -> list[tuple]`	Run a query, enforced read-only at the Postgres session level
`table_exists(table_name: str, schema: str = "public") -> bool`	Check whether a table exists

query does not classify SQL text — it runs it on a connection pinned to READ ONLY (conn.set_session(readonly=True, ...)), so Postgres itself rejects any write. See server.py for why a regex/keyword blocklist was rejected in favor of this.

Environment Variables

Variable	Required	Default	Notes
`POSTGRES_HOST`	yes	—
`POSTGRES_PORT`	no	`5432`
`POSTGRES_DATABASE`	yes	—
`POSTGRES_USER`	yes	—	Used by `list_schemas`/`list_tables` and as the fallback for `query`
`POSTGRES_PASSWORD`	yes	—
`POSTGRES_READONLY_USER`	no	falls back to `POSTGRES_USER`	Used by `query` if set — see below
`POSTGRES_READONLY_PASSWORD`	no	falls back to `POSTGRES_PASSWORD`

Recommended: a dedicated read-only DB role

The session-level READ ONLY flag is one line of defense. For a second, DB-enforced line, run setup_readonly_role.sql once against your database (swap the placeholder database name and password first), then set POSTGRES_READONLY_USER/POSTGRES_READONLY_PASSWORD to that role's credentials. query will use it; list_schemas/list_tables keep using POSTGRES_USER.

Run locally

bash

pip install "data-connectors-ai[postgres,mcp]"
data-connectors-postgres-mcp

Use with an MCP client

json

{
  "mcpServers": {
    "postgres": {
      "command": "uvx",
      "args": ["--from", "data-connectors-ai[postgres,mcp]", "data-connectors-postgres-mcp"],
      "env": {
        "POSTGRES_HOST": "localhost",
        "POSTGRES_DATABASE": "your_database",
        "POSTGRES_USER": "your_user",
        "POSTGRES_PASSWORD": "your_password"
      }
    }
  }
}

Registry

Published at io.github.nagarjunr/data-connectors-postgres on the official MCP registry.

PostgreSQL Connector